Globally things are not any better, and perhaps they are more frightening. Twice – in 2016 and 2018 – the number affected globally exceeded 2 billion individuals. And these are just the ones that are reported. Many breaches do not get announced to avoid public scrutiny or embarrassment.
Perhaps you have received a letter which informs you that a bank or creditor or merchant you use has experienced such a breach. The letter tells you that “your information may have been accessed.” The vendor then goes on to say they are making it right by offering a year’s worth of some credit monitoring.
Recently while visiting with a leading construction program management firm in Houston, I heard of two such attacks inflicted on its clients. One was a school district in Texas which paid $35,000 in bitcoin to have its data – and doors – unlocked. The hackers had not only taken over the district’s servers, but they also entered the building security system and locked all the doors and entry ways at several schools. School actually had to be canceled for a week!
In looking for more information on this incident, I learned that dozens and dozens of Texas school districts have paid this kind of ransom. The most common practice is to just pay the hackers and try to beef up security later.
The second attack was on a private company, a design firm involved in hundreds of projects, which runs its business with multiple Internet-based communication and information management systems. This firm did not disclose how much it cost to get out of this jam.
Most of these attacks are not intended to harm the attacked; they are done for profit. Week after week in 2019, another Texas school district was hit. Each time, the ransom amount was based on the district’s size, wealth and ability to pay. The attackers kept the number just low enough to make paying ransom easier than trying to regain control of its IT infrastructure.
Schools are particularly vulnerable because they are under such public scrutiny, they are underprepared, and they tend to pay these ransoms quickly. Understaffed/under-resourced is a common condition for most government agencies. Few have staff dedicated to cybersecurity.
Other industries are attacked even more often. Health care, financial services and manufacturing top the list of the most attacked industries. And the attacks can be malicious. Hacktivists, as they are called, work to cause damage and interfere with the supply chain, based on ideologic views. Last year a group called Predatory Sparrow caused a fire in an Iranian steel mill in response to unspecified acts of aggression carried out by the Islamic republic.
Previously the same group had taken Iran’s national fuel station payment system offline and highjacked digital billboards, posting questions to Ayatollah Ali Khamenei, the country’s supreme leader, asking, “Where is our fuel?”
What should we do? With such a volume of bad actors trying to access data, what can organizations that hold sensitive data do to protect themselves?
START WITH YOUR EMPLOYEES
Security professionals agree that the first place to focus is training your employees. Every individual must understand the constant threat and the potential harm to the entire organization. Companies must establish policies and practices that reflect how serious the threat is. Requiring strong passwords – which are changed every few months – using multifactor authentication and establishing appropriate Internet use guidelines are just a few basic ideas.
More importantly, companies must work to create a culture of data security.
The Henry M. Jackson Foundation is a nonprofit focused on military medical research. Using an outside consultant, it conducted an internal phishing scam, sending emails to all employees, but at varying times. These emails asked for sensitive information, for example, “Update Your Account Profile.” If employees clicked the phishing link, they were greeted with a pop-up alerting them to the scam and providing instructions on how to avoid making this mistake in the future. Initially the click rate was 27 percent. By continuing this internal campaign, the company was able to reduce the click rate to just 3 percent. (Source: Cyber Security Hub, cshub.com)
Security must become part of your culture. And company leaders must set an example.
KEEP SOFTWARE UPDATED
Outdated security software is an invitation to hackers. We all live and work in cyberspace, and every desktop, laptop and mobile device is a possible open door. IT staff must be diligent about maintaining the latest security software and appropriate updates on all these doors, in the same way building managers must be sure that no one outside the organization is given access to the physical facilities.
For construction owners, this problem is exacerbated because so much building equipment is now controlled with software via Wi-Fi. If you have a Wi-Fi thermostat at home, you have a potential entry point for hackers. Construction owners have various equipment specified, procured, shipped, installed, commissioned and put into service long before they have proper data delivered on how to maintain and operate this equipment. It’s a problem that has existed for some time, often referred to as “asset data handoff” or “the project after the project.” This lack of data at startup leaves the owner incredibly vulnerable because his equipment is put into service having missed several versions of security updates.
Recall the 2018 story of a Las Vegas casino having been hacked through the Wi-Fi-enabled thermometer on a fish tank. What did they steal? The personal data of all the individuals on the casino's “high roller” list.
Construction owners can combat this threat by adopting a new method called asset centric project management (ACPM). ACPM delivers the necessary asset data – including equipment software information – to the owner’s operation and maintenance systems as it is authored during design or procurement or any pre-occupancy phase. The owner can now insist on all security patches being updated as part of the commissioning process. (Read more about ACPM at www.kahua.com/why-kahua/asset-centric)
HAVE A SECURITY PLAN
Your security plan is your summary of practices in place to keep your data secure. It should spell out what hardware and software you have in place to enhance security. It should also include your security policies and training practices which support the policies. And you should have given thought to what you’ll do when a breach happens. Do you have the best backup procedures possible? Do you secure backup data differently? Do you have cyber insurance that will pay ransomware demands?
CONSIDER HIRING THIRD-PARTY SECURITY EXPERTS
If your team does not have the experience or the time needed to dedicate to security, you’d be better off hiring an outside firm to help in this area. Data security can’t be an issue you avoid dealing with, not for any reason. If your team can’t make it a high priority, you must expand your team.
APPLY THE GOLD STANDARD
Established by a memo from President Obama’s Office of Management and Budget in 2011, the Federal Risk and Authorization Management Program (FedRAMP) delivers consistent, best-practice security protocols for cloud service providers (CSP) serving the federal government. A year after the idea was born, the General Services Administration (GSA) created the FedRAMP Program Management Office (PMO) and began creating what is now the national gold standard for cloud computing security.
FedRAMP requires software and infrastructure providers to adhere to strict requirements and to be constantly audited for compliance. For example, my firm, Kahua, had to implement 327 different controls to achieve FedRAMP “moderate” authorization in January of 2022. The iterative process took 43 months, with no unusual delays. We spent thousands and thousands of hours working to achieve the authorization, and Kahua became the only full-featured project information management system (PMIS) to be FedRAMP authorized.
A fully authorized FedRAMP platform authorizes the infrastructure of the system as well as the software that runs on top of that infrastructure. An organization can have confidence in these systems properly protecting their data no matter where it is within that system. Here’s a difference owners need to carefully note: Solutions that simply host their services on FedRAMP-authorized infrastructure are only providing protection for that data at-rest. All other aspects of the system are unknown and put an organization's data at serious risk.
When federal agencies are purchasing software to manage project information, they are now beginning to require FedRAMP. In 2020, a nonprofit was created to help state and local government entities achieve the same kinds of security standards. StateRAMP is now being deployed in 20 states and more local government agencies. As you’d expect, StateRAMP is now required in many solicitations and RFPs. Speaking about the process of achieving FedRAMP authorization, Kahua CTO Colin Whitlatch said, “We spent several thousand man-hours achieving this goal. That said, much of the investment has had a positive effect on everything else we do. This process allowed us to put controls in place to deliver a more secure platform for all our clients, not just our FedRAMP clients.”
Cloud-based PMIS solutions offer scalability, flexibility and remote access, enhancing project management efficiency. However, these advantages need to be balanced with stringent security measures, which FedRAMP addresses.
Government construction projects often require collaboration among multiple agencies, contractors and stakeholders. A FedRAMP-authorized PMIS provides a secure platform for seamless collaboration while maintaining data confidentiality and integrity. By using a PMIS that aligns with FedRAMP standards, agencies can ensure a consistent approach to security across different projects and systems.
DO NOT SETTLE. DO NOT REST.
The final thought on this issue is to take it seriously. If your data is important, treat it like it is. Do not settle for lax policies, standards or people. Insist on making data security a high priority. And do not rest. Technology is ever advancing, and your methods for protecting your data must advance at the same intense pace. You will never get to a point where you can say, “That’s it. We are now secure.” Think like the bad actors, who will not stop in their attempts to rob you.
Additional Learning OpportunityADDITIONAL LEARNING OPPORTUNITY
If you’re in the construction industry and interested in this topic, consider attending “What Owners Should Know About Cloud Computing Security,” a seminar to be held on Oct. 30 at the CMAA National Conference in Washington, D.C. Kahua CTO Colin Whitlatch will join representatives from the GSA and cybersecurity researchers from Hatton Research on a panel hosted by Kahua’s Chief Evangelist Nicholas Johnson. For more information on the CMAA event, see https://www.cmaanet.org/conferences.
Author Bio:
Nicholas Johnson is the chief evangelist for Kahua, a leading construction project management information services company based in Alpharetta, Ga.
